3

Here is a piece of code that generates an internal compiler error if I compile and run it with clang having memory sanitizer enabled.

It mainly just puts some data into an SSE register and calls a function to convert half floats to floats:

int main(int argc, char** argv) {
  // Just some memory to load from.
  alignas(64) std::array<uint16_t, 16> array;
  array.fill(0);

  __m128i ints = _mm_set1_epi64x(*reinterpret_cast<const uint64_t*>(array.data()));

  // msan is happy with this version, and both versions work if we compile with anything other than -Og or -O1
  //   __m128i ints = _mm_set_epi64x(*reinterpret_cast<const uint64_t*>(array.data()), 0);

  __m128 floats = _mm_cvtph_ps(ints);

  std::array<float, 4> p;
  _mm_storeu_ps(p.data(), floats);
  std::cout<< p[0] << p[3] << std::endl;

  return 0;
}

See also https://godbolt.org/z/5xva3q -

Running the binary produced by clang10.0.1 -Og -g -std=c++17 -march=haswell -fsanitize=memory -fsanitize-memory-track-origins produces this output:

Program returned: 77
==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x4a5f00  (/app/output.s+0x4a5f00)
    #1 0x7f1f2b3a0b96  (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #2 0x41f369  (/app/output.s+0x41f369)

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/app/output.s+0x4a5f00) 
  ORIGIN: invalid (0). Might be a bug in MemorySanitizer origin tracking.
    This could still be a bug in your code, too!
Exiting

I have no idea why this would cause an error, and it only happens for specific optimization settings. It looks like a potential bug in clang to me, but I wanted to confirm this with a larger audience.

Edit: This seems to be fixed in the trunk version of clang.

Fabian Langguth
  • 31
  • 2
  • `*reinterpret_cast(array.data())` is strict-aliasing UB. You're dereferencing the pointer *yourself*, not passing a pointer arg to an intrinsic like `_mm_loadu_si64` or `_mm_loadl_epi64`. – Peter Cordes Sep 07 '20 at 17:46
  • 1
    Oh, but you're actually talking about an *internal* error in the checker, which you didn't bother to quote. The wording implies that's a clang/LLVM bug. You should report it on https://bugs.llvm.org/ with this as a [mcve]. (It's saying it doesn't rule out it being a bug in your code, but that it is pretty definitely a bug in the sanitizer.) I edited your question to quote the actual error output you omitted. – Peter Cordes Sep 07 '20 at 17:50
  • Thanks, sorry I should have clarified that better. I also just realized that it seems to be fixed in the trunk version of clang already. – Fabian Langguth Sep 08 '20 at 08:46

0 Answers0